Traq
Monthly
An OAuth2 authorization flaw in traQ prior to 3.28.3 lets a malicious OAuth client escalate privileges by sending a silent authorization request (prompt=none) with an empty or omitted scope parameter. Because the consent check was compared against the empty requested scope set while all of the client's registered scopes became eligible for issuance, an attacker controlling a registered client can obtain an access token carrying broader scopes than the victim previously approved. Only users who already consented to a strict subset of that client's scopes are exploitable, while users who never consented still receive consent_required; exploitation requires a victim with an active authenticated session, and no public exploit code or active exploitation is identified in the available data (EPSS not provided, not in CISA KEV).
Stored cross-site scripting in traQ prior to 3.28.3 lets an authenticated user with file-upload capability stage a crafted SVG or HTML file that executes attacker-controlled JavaScript in another user's browser when that user opens the file URL, but only on instances configured with TRAQ_STORAGE_TYPE=local. The attacker needs an account with upload permission and the victim must actively open the crafted URL, so exploitation is not unauthenticated or zero-interaction. The issue is fixed in 3.28.3; no public exploit was identified at time of analysis.
An OAuth2 authorization flaw in traQ prior to 3.28.3 lets a malicious OAuth client escalate privileges by sending a silent authorization request (prompt=none) with an empty or omitted scope parameter. Because the consent check was compared against the empty requested scope set while all of the client's registered scopes became eligible for issuance, an attacker controlling a registered client can obtain an access token carrying broader scopes than the victim previously approved. Only users who already consented to a strict subset of that client's scopes are exploitable, while users who never consented still receive consent_required; exploitation requires a victim with an active authenticated session, and no public exploit code or active exploitation is identified in the available data (EPSS not provided, not in CISA KEV).
Stored cross-site scripting in traQ prior to 3.28.3 lets an authenticated user with file-upload capability stage a crafted SVG or HTML file that executes attacker-controlled JavaScript in another user's browser when that user opens the file URL, but only on instances configured with TRAQ_STORAGE_TYPE=local. The attacker needs an account with upload permission and the victim must actively open the crafted URL, so exploitation is not unauthenticated or zero-interaction. The issue is fixed in 3.28.3; no public exploit was identified at time of analysis.